This query template returns events for all "Added Tag" events for users belonging to domain hull.io where the property tag equals Video Game Characters
Due to the way data is stored (as nested objects), querying on event properties requires to format the query in a slightly different way. See how to format such a query below. The nested part of the query is the one of interest.
Note: replace
tagby the name of the property you wish to query, andVideo Game Charactersby it's value. This query applies to string properties. If you want to query on Numbers or other types, first look at the response format to define which key to access.
POST https://{{ organization}}/api/v1/search/events
{
"query": {
"bool": {
"filter": [
{
"has_parent": {
"parent_type": "user_report",
"query": {
"terms": {
"email": [
"hull.io"
]
}
}
}
},
{
"nested": {
"path": "props",
"query": {
"bool": {
"filter": [
{
"term": {
"props.field_name": "tag"
}
},
{
"term": {
"props.text_value.raw": "Video Game Characters"
}
}
]
}
}
}
},
{
"terms": {
"event": [
"Added Tag"
]
}
}
]
}
},
"raw": true,
"page": 1,
"per_page": 10,
"sort": {
"created_at": "desc"
}
}